mirror of
https://github.com/kuhyx/testsAndMisc.git
synced 2026-11-11 15:54:18 +01:00
Krzysztof kuhy Rudnicki
343d38eaf8
setup_dns_blocker.sh turns this PC into a DNS server that serves the identical /etc/hosts blocklist to the whole LAN with no per-device app, by feeding generate_hosts_file.sh output into dnsmasq via addn-hosts (same StevenBlack variant + custom entries + unblocks). Adds status/ refresh subcommands, a daily refresh timer, Restart=always, and logging to /var/log/dns-blocker/. Because the ISP router cannot advertise a custom DNS server, a dhcp/ dhcp-off mode makes the PC the LAN DHCP server (static IP via nmcli with a gateway-ping self-check and safe, always-online rollback), handing out itself as the DNS server so every device is blocked automatically. setup_wireguard_ssh.sh gains an allow-dns subcommand that opens DNS (53, LAN saddr) and DHCP (67) in the single-owner nftables ruleset. The DHCP accept rule is placed before 'ct state invalid drop' because the 0.0.0.0->255.255.255.255 DHCP broadcast is classified INVALID and was otherwise dropped. Firewall detection now reads the actual loaded ruleset (a ruleset can be loaded while nftables.service reads inactive) and avoids a grep -q/pipefail SIGPIPE false-negative. Verified end-to-end: Pixel-6a leased 192.168.1.82 with DNS 192.168.1.43; youtube.com blocked, legit sites resolve. Regression tests added. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018pqSnrLt8QoWup7n2Ymk77 |
||
|---|---|---|
| .. | ||
| contracts | ||
| evidence | ||
| memory | ||
| plans | ||
| sessions | ||
| specs | ||
| workflows | ||